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Presentation Outline 

• RASCAL UH-60 in-flight simulator 

• Simulation in support of safety monitor design 
specification development — — _ 

• Failure/Recovery Rating Scale development 

• Use of F/R Rating Scale as a common element 
between simulation and flight evaluation 

• Flight envelope expansion without benefit of 
simulation 

• Summary observations 












Safety Monitor 
cification Development 


• Large-scale motion simulation 
used to determine required level 
of automated FBW system 
safety monitoring 

- NASA Ames Vertical Motion 
Simulator 

• Evaluation and Safety Pilot 
stations in separate locations 

- Multiple candidate flight 
control implementations 
investigated 

— Broad spectrum of failure 
transients injected throughout 
the anticipated, operational 
maneuver envelope 




Failure/Recovery Rating Scale Development 

• Existing pilot rating scales (e.g., C-H Rating 
Scale) did not adequately capture the 
discontinuous nature of failure transients 
and subsequent recovery effort 

• Failure/Recover Rating Scale developed to: 

- Describe effect of failure transients on safety of 
flight and pilot recovery action 

- Allow correlation of results with existing 
airworthiness criteria to determine quantitative 
reliability design goals 





F ailure/Recovery Rating Scale 


EFFECT OF FAILURE 


A81LJTY T O RECOVER 


RATING 


Minima) excursions in aircraft states 


Corrective control action not required 


-< > 


Minor excursions in aircraft suits 


Excursions in aircraft sates or controls 
moderate but not objectionable 




Corrective control inputs accomplished with 
minimal urgency 


Excursions in aircraft sates orcontrois 
objectionable - operational flight envelope 
exeedence nota ftctor 




Corrective control Inputs accomplished with 
moderate sense of urgency 


Corrective control action requires immediate 
and considerable pilot effort 


Excursions in aircraft sates or controls very 
objectionable, or aircraft operational flight 
l envelope limits approached 


Corrective control action requires immediate 
and extensive pitot effort 




Excursions in aircraft sates may result in 
encounter with obsuctes. unintentional 
landing or exceedence of operational 
tight envelope boundaries 


Successful recovery very dependent on immedhte 
critical controlaction vnth maximum pitotattention I 


Recovery marginal: safe recover)' cannot be 
assured even with maximum pflot attention 


Catastrophic encounter with obstacles 
or structural feilure 


No possibility of averting causcrophe 


(Yaflure occurs^) 


Ref. Hindson. ec aL “A Piot Rating Scale for Evaluating failure Transients 
*» Electronic RightControl Systems," AiAA-%~2827 


Correlation of Failure Ratings 
with Airworthiness Criteria 

• Acceptability of a control system failure is a 
function of both: 

- The severity of the failure, and 

- Its probability of occurrence 

• U.S. and U.K., civil and military design 
documents used to correlate Failure ratings 
obtained from simulation with equivalent 
quantitative probabilities of failure as design 
guidance 







t Test Verificat 


Command Step and Servo Rate 
Monitors 

Flight conditions: high hover and forward flight 
Simulated single axis failure injections 

- All four cockpit control axes 

— up to 100% of maximum RFCS servo rate 
Failure dynamics and required recovery effort 
evaluated using the F/R Rating Scale 

Pilot reaction time vs. aircraft excursion evaluated 
In excess of 700 in-flight simulated failures 








Flight Test Determination 

Minimum Safe Operational Altitude 

• RASCAL funded to provide risk reduction testing 
for FBW upgrade of UH-60M 

• 60M control laws and control inceptors to be 
installed in RASCAL and evaluated using the 
Mission Task Elements of ADS-33E--at published 
altitudes 

- Arbitrarily-selected minimum engaged altitude to be 
replaced by “minimum safe operational altitude” 

• With simulation not an option, a flight experiment 
was initiated to define the required minimum 
altitude 


Flight Test Determination (cont.) 

Minimum Safe Operational Altitude 

• Step 1 : Fly each MTE, unengaged, to define necessary 
maneuvering envelope 

• Step 2: Identify attitude responses to a 100% servo rate 
hardover, with a 0.5 sec disengage time 

• Step 3 : Re-fly each MTE, unengaged, with safety pilot- 
induced, simulated failures in most critical axis, at most 
critical time in maneuver 

- Maximum attitude change die sum of the required maneuver plus 
the worst case failure. 

- Maneuver altitude decreased until pilot no longer accepting of 
aircraft state change/recovery requirements 





Final flare requires approximately +14 deg nose 
attitude to terminate maneuver 
+27 deg of additional nose up attitude applied to 
simulate a nose-up pitch hardover at flare termination 

Limit ground clearance approximately 10 ft agl 
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This kind of exploratory 
work is more 
appropriately done in 
simulation — when one is 
available 

- Eliminates risk to a 
valuable research facility 

- Test conditions more easily 
repeated for multiple 
subject safety pilots 

- Test data much easier to 
collect and analyze 


Positive aspects of doing the 

envelope testing in the aircraft 

- The inevitable “failure 
recovery training” received by 
the subject Safety Pilots is very 
realistic 

- The flight test environment 
provides a level of Safety Pilot 
stress absent from simulation 
under even the best of 
conditions 

- Safety Pilot subjects have a 
unique opportunity to validate 
the published envelope against 
their own comfort leveL 








Summary Observations 


• High-fidelity simulation is essential for design 
specification development efforts 

• Flight testing of the resultant hardware is, 
likewise, essential in a low risk environment 

• True edge-of-the envelope testing is best done in a 
return to high-fidelity simulation 

• Absent the availability of simulation: 

- Flight test for envelope limits, but always with 
sufficient step-wise build-up to ensure that the limits 
are approached but not exceeded 




